DLSV2-637 Sanitise html strings submitted to database using Jodit edi…

[manishagarwalnhs]

…tor throughout solution

JIRA link

DLSV2-637

Description

The html editor is sanitised to only allow clean html send to the server. At the server, the html string is again sanitised to make sure no risky html is eventually saved in the database. This is done using the dompurify library at client side and HTMLSanitizer package on the server side. The server side only removes iframe and img html tags but this can be changed to add more html tags if we want to.

Screenshots

No Screenshots available

---

Developer checks

I have:

• Run the formatter and made sure there are no IDE errors.
• Written tests for the changes (accessibility tests, unit tests for controller, data services, services, view models, etc)
• Manually tested my work with and without JavaScript. Full manual testing guidelines can be found here: https://softwiretech.atlassian.net/wiki/spaces/HEE/pages/6703648740/Testing
• Updated/added documentation in Swiki and/or Readme. Links (if any) are below:
  • doc_1_here
• Updated my Jira ticket with information about other parts of the system that were touched as part of the MR and have to be sanity tested to ensure nothing’s broken.
• Scanned over my own MR to ensure everything is as expected.

[kevwhitt-hee]

Added yarn-lock file, updated version of dom-purify and fixed TypeScript lint errors. Tested with JS and non-JS and <script> tags get reliably stripped before storing HTML to database. Great work.